GDPR-compliant AI: the twelve-point checklist for any AI tool
Short answer
“GDPR-compliant” is not a label. It means you can show, for an AI tool, which personal data goes in, on what basis, where it ends up and how you protect it. Twelve points decide that: legal basis, purpose limitation, processing agreement, transfers, training, retention, access, logging, DPIA, no decisions about people, data subject rights and the breach process. A public AI service usually stumbles on transfers and training; your own environment makes most points a fact.
What GDPR-compliant means
The GDPR does not ban AI and has no compliance seal. It requires you to control processing and to be able to show it: accountability. For an AI tool that comes down to twelve questions. Answer all of them with evidence and the tool is compliant for your use. Leave one open and it is not, however good the rest. See Is ChatGPT GDPR-compliant? for the application to the best-known tool.
The checklist
| # | Question | What you need |
|---|---|---|
| 1 | Legal basis: on what ground do you process personal data with this tool? | A basis per purpose, recorded in the processing register |
| 2 | Purpose limitation: does the tool use the data only for your purpose? | Contractual exclusion of other use by the supplier |
| 3 | Processing agreement: is there an agreement under Article 28? | Signed, with instructions, sub-processors and audit |
| 4 | Transfers: does the data stay in the EU and out of reach of foreign law? | Location and parent company of the supplier; see The CLOUD Act and European data |
| 5 | Training: does the model learn from your input? | Exclusion, demonstrably; on your own hardware a fact |
| 6 | Retention: how long does the tool keep prompts and output? | A period you set and can check yourself |
| 7 | Access: does the tool see only what the user may see? | Roles that follow your own permissions |
| 8 | Logging: can you see afterwards who did what? | An audit log you manage yourself |
| 9 | DPIA: has the processing been assessed? | A DPIA where a high risk is likely; see A DPIA for generative AI |
| 10 | Decisions: does the tool take decisions about people? | No, or with meaningful human involvement (Article 22) |
| 11 | Rights: can you carry out access, rectification and erasure? | A procedure that covers the AI tool too |
| 12 | Breach: do you know within 72 hours what happened? | The supplier’s notification deadline and an internal plan |
Public service or your own environment
With a public AI service, points 2, 4, 5, 6 and 8 are contract clauses you have to trust and check, and with a free or personal account they are missing altogether. With an environment of your own, a node that belongs to your organisation alone with open-weight models, the same points are technical facts: the data never leaves the organisation, the model does not learn, you set the retention and you manage the log. Points 1, 9, 10 and 11 remain your own work either way.
How to show it
- Put the AI tool in the processing register, with purpose, legal basis and categories of data.
- Keep the processing agreement, or the documentation of your own environment, with the register.
- Record the DPIA, even when the conclusion is that the risk is limited.
- Export the audit log periodically and keep the role matrix.
- Rehearse the breach process once with an AI scenario.
How werqly fits in
werqly is designed to make the technical points of this list true: a dedicated node in your server room or a dedicated node in a Dutch datacentre, open-weight models that do not learn from your data, roles per team and an audit log under your own control. The legal basis, the DPIA and data subject rights remain your work; werqly supplies the evidence for the rest.
Frequently asked questions
Questions on this topic
Is there a GDPR seal for AI tools?
No. The GDPR works with accountability: you must be able to show yourself that a processing operation is in order. Supplier certifications help as evidence but do not replace your own assessment.
Is a processing agreement enough?
No. A processing agreement governs the relationship with the supplier, not the legal basis, the DPIA, access within your organisation or data subject rights. It is one of the twelve points.
What is the biggest obstacle with public AI services?
Transfers and training. Many services run at US companies that fall under the CLOUD Act, and use input by default to improve models unless you have a business contract that excludes it.
Is an AI environment of your own automatically compliant?
No. The technical points hold, but legal basis, purpose limitation, DPIA, access per role and data subject rights still have to be set up. The difference is that you control that set-up yourself.
Sources
- Dutch Data Protection Authority — GDPR guidance and tool for generative AI (Dutch)
- EDPB — Guidelines 07/2020 on the concepts of controller and processor
This article is general information, not legal advice. Rules and guidance change; check the sources listed or ask your lawyer or DPO if in doubt.